CompTIA CS0-001 Online Practice Questions and Exam Preparation

CompTIA CS0-001 Online Questions & Answers

• Question 171:

  While reviewing web server logs, a security analyst notices the following code:

  

  Which of the following would prevent this code from performing malicious actions?

  A. Performing web application penetration testing
  B. Requiring the application to use input validation
  C. Disabling the use of HTTP and requiring the use of HTTPS
  D. Installing a network firewall in front of the application
  C. Disabling the use of HTTP and requiring the use of HTTPS

• Question 172:

  Which of the following command line utilities would an analyst use on an end-user PC to determine the ports it is listening on?

  A. tracert
  B. ping
  C. nslookup
  D. netstat
  D. netstat

• Question 173:

  A technician is running an intensive vulnerability scan to detect which ports are open to exploit. During the scan, several network services are disabled and production is affected. Which of the following sources would be used to evaluate which network service was interrupted?

  A. Syslog
  B. Network mapping
  C. Firewall logs
  D. NIDS
  A. Syslog

• Question 174:

  A business recently installed a kiosk that is running on a hardened operating system as a restricted user. The kiosk user application is the only application that is allowed to run. A security analyst gets a report that pricing data is being modified on the server, and management wants to know how this is happening. After reviewing the logs, the analyst discovers the root account from the kiosk is accessing the files. After validating the permissions on the server, the analyst confirms the permissions from the kiosk do not allow to write to the server data.

  Which of the following is the MOST likely reason for the pricing data modifications on the server?

  A. Data on the server is not encrypted, allowing users to change the pricing data.
  B. The kiosk user account has execute permissions on the server data files.
  C. Customers are logging off the kiosk and guessing the root account password.
  D. Customers are escaping the application shell and gaining root-level access.
  D. Customers are escaping the application shell and gaining root-level access.

• Question 175:

  A recent audit included a vulnerability scan that found critical patches released 60 days prior were not applied to servers in the environment. The infrastructure team was able to isolate the issue and determined it was due to a service being disabled on the server running the automated patch management application. Which of the following would be the MOST efficient way to avoid similar audit findings in the future?

  A. Implement a manual patch management application package to regain greater control over the process.
  B. Create a patch management policy that requires all servers to be patched within 30 days of patch release.
  C. Implement service monitoring to validate that tools are functioning properly.
  D. Set services on the patch management server to automatically run on start-up.
  D. Set services on the patch management server to automatically run on start-up.

• Question 176:

  When network administrators observe an increased amount of web traffic without an increased number of financial transactions, the company is MOST likely experiencing which of the following attacks?

  A. Bluejacking
  B. ARP cache poisoning
  C. Phishing
  D. DoS
  D. DoS

• Question 177:

  A security analyst wants to confirm a finding from a penetration test report on the internal web server. To do so, the analyst logs into the web server using SSH to send the request locally. The report provides a link to https://hrserver.internal/../

  ../etc/passwd, and the server IP address is 10.10.10.15.

  However, after several attempts, the analyst cannot get the file, despite attempting to get it using different ways, as shown below.

  

  Which of the following would explain this problem? (Choose two.)

  A. The web server uses SNI to check for a domain name
  B. Requests can only be sent remotely to the web server
  C. The password file is write protected
  D. The web service has not started
  A. The web server uses SNI to check for a domain name

• Question 178:

  A threat intelligence analyst who works for an oil and gas company has received the following email from a superior:

  "We will be connecting our IT network with our ICS. Our IT security has historically been top of the line, and this convergence will make the ICS easier to manage and troubleshoot. Can you please perform a risk/vulnerability assessment on

  this decision?"

  Which of the following is MOST accurate regarding ICS in this scenario?

  A. Convergence decreases attack vectors
  B. Integrating increases the attack surface
  C. IT networks cannot be connected to ICS infrastructure
  D. Combined networks decrease efficiency
  B. Integrating increases the attack surface

• Question 179:

  A security analyst received an alert from the antivirus software identifying a complex instance of malware on a company's network. The company does not have the resources to fully analyze the malware and determine its effect on the system. Which of the following is the BEST action to take in the incident recovery and post-incident response process?

  A. Wipe hard drives, reimage the systems, and return the affected systems to ready state.
  B. Detect and analyze the precursors and indicators; schedule a lessons learned meeting.
  C. Remove the malware and inappropriate materials; eradicate the incident.
  D. Perform event correlation; create a log retention policy.
  C. Remove the malware and inappropriate materials; eradicate the incident.

• Question 180:

  A security analyst has performed various scans and found vulnerabilities in several applications that affect production data. Remediation of all exploits may cause certain applications to no longer work. Which of the following activities would need to be conducted BEFORE remediation?

  A. Fuzzing
  B. Input validation
  C. Change control
  D. Sandboxing
  C. Change control